Fixing default active response
This commit is contained in:
parent
deaffd9c8e
commit
ce4665ef3e
@ -255,17 +255,6 @@ wazuh_manager_config:
|
|||||||
decoders_path: 'custom_ruleset/decoders/'
|
decoders_path: 'custom_ruleset/decoders/'
|
||||||
rule_exclude:
|
rule_exclude:
|
||||||
- '0215-policy_rules.xml'
|
- '0215-policy_rules.xml'
|
||||||
active_responses:
|
|
||||||
- command: 'restart-ossec'
|
|
||||||
location: 'local'
|
|
||||||
rules_id: '100002'
|
|
||||||
- command: 'win_restart-ossec'
|
|
||||||
location: 'local'
|
|
||||||
rules_id: '100003'
|
|
||||||
- command: 'host-deny'
|
|
||||||
location: 'local'
|
|
||||||
level: 6
|
|
||||||
timeout: 600
|
|
||||||
syslog_outputs:
|
syslog_outputs:
|
||||||
- server: null
|
- server: null
|
||||||
port: null
|
port: null
|
||||||
|
|||||||
@ -395,7 +395,8 @@
|
|||||||
|
|
||||||
|
|
||||||
<!-- Active Response Config
|
<!-- Active Response Config
|
||||||
{% for response in wazuh_manager_config.active_responses %}
|
{% if wazuh_manager_config.active_responses is defined %}
|
||||||
|
{% for response in wazuh_manager_config.active_responses %}
|
||||||
<active-response>
|
<active-response>
|
||||||
<disabled>{% if response.disabled is defined %}{{ response.disabled }}{% else %}no{% endif %}</disabled>
|
<disabled>{% if response.disabled is defined %}{{ response.disabled }}{% else %}no{% endif %}</disabled>
|
||||||
{%if response.command is defined %}<command>{{ response.command }}</command>{% endif %}
|
{%if response.command is defined %}<command>{{ response.command }}</command>{% endif %}
|
||||||
@ -407,7 +408,8 @@
|
|||||||
{%if response.timeout is defined %}<timeout>{{ response.timeout }}</timeout>{% endif %}
|
{%if response.timeout is defined %}<timeout>{{ response.timeout }}</timeout>{% endif %}
|
||||||
{%if response.repeated_offenders is defined %}<repeated_offenders>{{ response.repeated_offenders }}</repeated_offenders>{% endif %}
|
{%if response.repeated_offenders is defined %}<repeated_offenders>{{ response.repeated_offenders }}</repeated_offenders>{% endif %}
|
||||||
</active-response>
|
</active-response>
|
||||||
{% endfor %}
|
{% endfor %}
|
||||||
|
{% endif %}
|
||||||
-->
|
-->
|
||||||
|
|
||||||
<!-- Files to monitor (localfiles) -->
|
<!-- Files to monitor (localfiles) -->
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user